Learn how the ACME protocol automates SSL/TLS certificate lifecycles. See how it streamlines certificate issuance and renewal, and why it matters more than ever as certificate lifetimes shrink.
Quick Overview
The Automated Certificate Management Environment (ACME) protocol standardizes how servers obtain and renew SSL/TLS certificates. It lets web servers prove domain ownership and receive certificates without manual intervention.
ACME automates certificate issuance and renewal, strengthens website security, reduces human error in certificate management, and enjoys wide support among certificate authorities and web servers.
Understanding ACME
The Internet Security Research Group (ISRG) designed the ACME protocol to automate certificate issuance and renewal. ACME has revolutionized certificate management since its introduction. Many Certificate Authorities (CAs) have adopted it, and it now carries internet-standard status as RFC 8555.
Before ACME, administrators managed SSL/TLS certificates through a manual, time-consuming process. Website administrators had to complete each of these steps by hand:
- Generate a Certificate Signing Request (CSR)
- Prove domain ownership through various methods
- Submit the CSR to a CA
- Wait for approval and certificate issuance
- Manually install the certificate on their web server
- Remember to renew the certificate before it expires
This manual process invited human error and often produced expired certificates, which triggered security warnings for website visitors.
ACME removes the manual steps by defining a standard protocol for communication between web servers and Certificate Authorities. The web server (the ACME client) requests a certificate from the CA (the ACME server) for a specific domain. The CA then issues a domain validation challenge, usually asking the client to place a specific file on the web server or publish a DNS record. Once the CA confirms the client has completed the challenge, it issues the certificate and the client installs it automatically. This workflow runs the full process end to end, from initial setup through every renewal.
Benefits of Using ACME
The ACME protocol offers numerous advantages for website owners and administrators:
- Automation: ACME removes manual intervention from certificate management
- Improved Security: Regular, automatic renewals keep certificates current at all times
- Reduced Errors: Automation minimizes human error throughout the certificate process
- Scalability: Teams can manage certificates across many domains or subdomains without added overhead
- Standardization: As an open standard, ACME promotes interoperability between different systems
Why Certificate Lifetimes Keep Shrinking (and Why ACME Matters More Than Ever)
The CA/Browser Forum, the industry body that sets baseline requirements for publicly trusted certificates, approved Ballot SC-081 to phase in shorter maximum certificate lifetimes. The schedule reduces the current 398-day maximum down to 47 days by March 15, 2029:
- March 15, 2026: Maximum lifetime dropped to 200 days
- March 15, 2027: Maximum lifetime drops to 100 days
- March 15, 2029: Maximum lifetime drops to 47 days
The domain validation reuse period shrinks on the same schedule, falling to just 10 days by 2029. Together, these changes mean organizations will renew and revalidate certificates far more often than they do today, which makes manual certificate management increasingly impractical. Read the full breakdown in SSL’s guide to the 200-day certificate deadline for the reasoning behind the change and how to prepare.
ACME already solves the operational challenge these shorter lifespans create. Because it automates issuance, validation, and renewal, teams that adopt ACME today build the infrastructure they need to handle every future reduction without added manual work.
Implementing ACME
To start using ACME for your websites, follow these steps:
Follow these steps to start using ACME for your websites:
- Choose an ACME Client: Select a client that receives active maintenance, offers clear documentation, supports your operating system and web server, and includes the features you need (for example, wildcard certificates or multiple domain support).
- Install the ACME Client: Installation steps vary by client and system. You might use a package manager, download the client from the developer’s website, or clone a repository and build the client from source. Always check the official documentation for your chosen ACME client for specific instructions.
- Configure the Client: Set up your ACME client with your domain details and preferred settings. This usually means specifying the domain(s) you want to secure, the web server you use (Apache or Nginx, for example), and where to store the certificates.
- Request a Certificate: Run your ACME client to start the certificate request process. The client generates a certificate signing request, proves domain ownership to us, then receive and install the certificate.
- Configure Your Web Server: Most ACME clients configure your web server automatically, though your setup may need manual adjustments. For Apache, confirm your virtual host configuration includes the paths to your new certificate files. For Nginx, update your server block with the paths to the new certificate and key files.
- Set Up Automatic Renewal: CA/Browser Forum rules now cap the maximum lifetime of publicly trusted TLS certificates at 200 days, and that ceiling will keep shrinking (see the section below). Set up automatic renewals so your certificates stay current without manual tracking. Most ACME clients include built-in renewal mechanisms, and you can typically schedule a cron job or scheduled task to run the renewal process regularly.
Advanced ACME Features
ACME supports issuing wildcard certificates, which secure a domain and all its subdomains under one certificate. Requesting a wildcard certificate requires a DNS-01 challenge for domain validation, since HTTP-01 challenges cannot validate wildcard coverage. ACME also defines a standardized way to revoke certificates that are compromised or no longer needed.
Troubleshooting Common ACME Issues
Watch for these common issues when you implement ACME:
- Rate Limiting: Many ACME CAs impose issuance rate limits to prevent abuse. SSL imposes no issuance rate limits on its ACME service, so this concern does not apply to SSL customers regardless of how many certificates they manage.
- Connectivity Issues: Confirm your server can reach our ACME servers, and check firewall rules if you run into connection problems.
- Domain Validation Failures: A misconfigured web server can block successful domain validation, so confirm your server correctly serves challenge responses.
- DNS Challenges: For DNS-01 challenges, confirm your DNS records are set up correctly and have propagated.
- Permission Errors: ACME clients often need elevated permissions to write certificates and configure web servers, so grant the appropriate privileges when necessary.
ACME FAQs
Q: Can I use ACME to order SSL/TLS certificates from SSL?
A: Yes. SSL supports ACME for Domain Validation (DV) certificate issuance today, with OV and EV issuance via ACME slated for future release. Read SSL/TLS Certificate Issuance and Revocation with ACME and ACME SSL/TLS Automation with Apache and Nginx for step-by-step guidance.
Q: What is the lifetime of SSL/TLS certificates purchased from SSL.com via ACME?
A: SSL issues all certificates via the ACME protocol with a 200-day maximum lifetime, in line with the current CA/Browser Forum requirement. This maximum will drop to 100 days on March 15, 2027, and to 47 days by March 15, 2029, so plan your automation accordingly.
Q: Which types of certificates can I order from SSL.com with ACME?
A: Any SSL customer can order the following SSL/TLS certificate products via the ACME protocol:
Q: Do SSL.com’s Reseller and Volume Purchasing discounts apply to certificates ordered with ACME?
A: Yes. Participants in SSL.com’s Reseller and Volume Purchasing Program will receive the wholesale discounts associated with their reseller and volume purchasing tier when they request certificates with the ACME protocol. Resellers can also generate ACME credentials for their customers.
Automate Your Certificate Lifecycle
By automating the certificate lifecycle, ACME strengthens internet security, cuts administrative overhead, and delivers a smoother experience for website operators and visitors alike.
As you implement ACME for your own websites, remember to:
- Choose a reliable ACME client compatible with your environment
- Monitor your certificate status and renewal processes regularly
- Keep your ACME client and web server software up-to-date
- Follow security best practices for storing and managing your certificates
With ACME, you can maintain HTTPS across your websites through a seamless, automated process, and focus on other priorities while your certificates stay secure.
Ready to automate your certificate lifecycle? Get started with SSL’s ACME integration and prepare your infrastructure for every certificate lifetime reduction ahead.
